Back to Checks
aws

VPC has Network Firewall enabled

networkfirewall_in_all_vpc
Service: networkfirewallSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:AwsEc2Vpc

VPCs with an AWS Network Firewall associated to the same VPC to inspect and filter network traffic.

Identifies VPCs that do not have a Network Firewall resource linked to them.

Prowler logoProwlerprowler-provider-aws

Risk

Without a Network Firewall, VPC traffic can bypass deep inspection and centralized policy enforcement, enabling data exfiltration, command-and-control, and lateral movement. Confidentiality is reduced by unmonitored flows; integrity and availability are threatened by malware and disruptive traffic.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks networkfirewall_in_all_vpc

Recommendation

Deploy AWS Network Firewall in each VPC or centralize inspection through a dedicated hub VPC.

Adopt a default-deny posture with least-privilege rules, restrict egress to required destinations, segment workloads (defense in depth, zero trust), and enable logging to monitor and tune network policies.

Remediation

CLI

aws network-firewall create-firewall --firewall-name <example_resource_name> --firewall-policy-arn <example_resource_id> --vpc-id <example_resource_id> --subnet-mappings "SubnetId=<example_resource_id>"

Terraform

# Create a Network Firewall in the VPC
resource "aws_networkfirewall_firewall" "<example_resource_name>" {
  name                = "<example_resource_name>"
  firewall_policy_arn = "<example_resource_id>"  # Critical: required policy
  vpc_id              = "<example_resource_id>"  # Critical: associates firewall to the VPC (fixes the check)

  subnet_mapping {                                # Critical: creates firewall endpoint in the VPC
    subnet_id = "<example_resource_id>"
  }
}

NativeIaC

# CloudFormation: Create a Network Firewall in the VPC
Resources:
  <example_resource_name>:
    Type: AWS::NetworkFirewall::Firewall
    Properties:
      FirewallName: <example_resource_name>
      FirewallPolicyArn: <example_resource_id>  # Critical: required policy for the firewall
      VpcId: <example_resource_id>              # Critical: associates the firewall to the target VPC (fixes the check)
      SubnetMappings:                           # Critical: creates firewall endpoints in the VPC
        - SubnetId: <example_resource_id>

Other

1In the AWS Console, go to Network Firewall > Firewalls > Create firewall
2Enter a name and select the target VPC
3Select an existing Firewall policy (or create one when prompted)
4Add at least one subnet from the VPC under Subnet mappings
5Choose Create firewall
6Verify the firewall shows under the selected VPC

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.networkfirewall.networkfirewall_client import (
    networkfirewall_client,
)
from prowler.providers.aws.services.vpc.vpc_client import vpc_client


class networkfirewall_in_all_vpc(Check):
    def execute(self):
        findings = []
        for vpc in vpc_client.vpcs.values():
            if vpc_client.provider.scan_unused_services or vpc.in_use:
                report = Check_Report_AWS(metadata=self.metadata(), resource=vpc)
                report.status = "FAIL"
                report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} does not have Network Firewall enabled."
                for firewall in networkfirewall_client.network_firewalls.values():
                    if firewall.vpc_id == vpc.id:
                        report.status = "PASS"
                        report.status_extended = f"VPC {vpc.name if vpc.name else vpc.id} has Network Firewall enabled."
                        break

                findings.append(report)

        return findings

References